Dolibarr: High-Severity SQLi and File Save Flaws Disclosed Together
Three vulnerabilities, including two high-severity flaws, were disclosed for the Dolibarr ERP/CRM system on August 27, 2026, affecting file handling, API security, and data import.
Key findings
- Three vulnerabilities disclosed for Dolibarr on August 27, 2026, impacting file handling, API authorization, and data import.
- CVE-2026-81730 (High, CVSS 8.2): Insecure file attachment saving in email collector allows arbitrary file writes.
- CVE-2026-81728 (High, CVSS 8.1): SQL injection in CSV/XLSX import wizard due to insufficient input sanitization.
- CVE-2026-81729 (Medium, CVSS 6.5): Incorrect authorization check for REST API document deletion.
- Affected versions range from 9.0.0 up to, but not including, 24.0.0; users should update to the latest release.
On August 27, 2026, a batch of three vulnerabilities was disclosed for the Dolibarr ERP/CRM system. These vulnerabilities, reported on the same day, affect various aspects of the software, including file handling, API authorization, and data import processes. The disclosures highlight potential risks for Dolibarr users if these issues are not addressed promptly.
One of the critical vulnerabilities, CVE-2026-81730, carries a CVSSv3 score of 8.2. It stems from an insecure file attachment saving mechanism in the email collector module. Specifically, Dolibarr versions 9.0.0 through 23.0.4 save inbound email attachments using filenames directly from MIME headers without proper sanitization. This could allow an attacker to craft a malicious filename that, when processed by the saveAttachment() function in htdocs/emailcollector/lib/emailcollector.php, could lead to arbitrary file write vulnerabilities.
Another high-severity vulnerability, CVE-2026-81728, with a CVSSv3 score of 8.1, is a SQL injection flaw present in Dolibarr versions prior to 24.0.0. This vulnerability resides within the CSV and XLSX import wizard. The import process in htdocs/imports/import.php retrieves update keys using GETPOST('updatekeys', 'array'), applying only a basic alphanohtml filter. This filter is insufficient to sanitize malicious SQL code, potentially allowing attackers to inject arbitrary SQL commands during data import operations.
The third vulnerability, CVE-2026-81729, is rated as Medium severity with a CVSSv3 score of 6.5. It affects Dolibarr versions before 23.0.4 and involves an authorization issue in the REST API for document deletion. The Documents::delete() function in htdocs/api/class/api_documents.class.php incorrectly checks for read permissions when handling DELETE requests to /api/index.php/documents. This contrasts with the builddoc() function, which correctly checks for write permissions, potentially allowing unauthorized users to delete documents via the API.
These vulnerabilities collectively underscore the importance of timely patching and security diligence for Dolibarr users. The file attachment vulnerability (CVE-2026-81730) and the SQL injection flaw (CVE-2026-81728) pose significant risks, potentially leading to data compromise or system takeover. The API authorization issue (CVE-2026-81729) further expands the attack surface by allowing unauthorized data manipulation. Users are advised to consult the official Dolibarr security advisories for specific version information and recommended upgrade paths to mitigate these risks.
The disclosed vulnerabilities affect a range of Dolibarr versions. Specifically, CVE-2026-81730 impacts versions from 9.0.0 up to 23.0.4. CVE-2026-81729 affects versions prior to 23.0.4. Lastly, CVE-2026-81728 is present in versions before 24.0.0. Users are strongly encouraged to update to the latest stable versions of Dolibarr to ensure these vulnerabilities are remediated. The specific patch versions are not detailed in the disclosure, but updating to the latest release is the recommended course of action.
This batch of vulnerabilities highlights the need for continuous security monitoring and prompt application of patches for the Dolibarr ERP/CRM system. By addressing these issues, organizations can protect their sensitive data and maintain the integrity of their business operations. Staying informed about security advisories and applying updates promptly are crucial steps in safeguarding against potential exploitation.